From ef4715ef695604a417d15390e42c43851ca5d0ff Mon Sep 17 00:00:00 2001 From: varunkasyap Date: Sat, 15 Nov 2025 10:36:46 +0530 Subject: [6.0.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__(). Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main. --- django/utils/feedgenerator.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'django/utils/feedgenerator.py') diff --git a/django/utils/feedgenerator.py b/django/utils/feedgenerator.py index a9eaffc205..b42417bbba 100644 --- a/django/utils/feedgenerator.py +++ b/django/utils/feedgenerator.py @@ -28,6 +28,7 @@ import mimetypes from io import StringIO from urllib.parse import urlparse +from django.forms.utils import flatatt from django.utils.encoding import iri_to_uri from django.utils.xmlutils import SimplerXMLGenerator @@ -95,12 +96,12 @@ class Stylesheet: return self._mimetype def __str__(self): - data = [f'href="{self.url}"'] - if self.mimetype is not None: - data.append(f'type="{self.mimetype}"') - if self.media is not None: - data.append(f'media="{self.media}"') - return " ".join(data) + attrs = { + "href": iri_to_uri(self._url), + "type": self.mimetype, + "media": self.media, + } + return flatatt(attrs).strip() def __repr__(self): return repr((self.url, self.mimetype, self.media)) -- cgit v1.3